Day 1: Assessing Threats, Assets, and Cyber Risk

Cyber Threat Landscape

• Identify common organizational cyber threats
• Map threats against exposed assets
• Distinguish likelihood versus potential impact
• Rank threats needing stronger controls

Cybersecurity Asset Exposure

• Set practical cybersecurity risk baseline
• Compare safeguards against required protection
• Identify weaknesses needing immediate treatment
• Define measurable risk reduction actions

Cybersecurity Risk Framework

• Identify assets needing enhanced protection
• Review threats vulnerabilities likely impact
• Define controls proportionate to risk
• Prepare combined risk decision register

Day 2: Establishing Security Policy, Access, and Protection

Cybersecurity Roles and Policies

• Assign roles across security workflow
• Allocate decision rights by level
• Eliminate overlapping conflicting responsibilities
• Build practical security accountability matrix

Cybersecurity Identity and Access

• Categorize access by system sensitivity
• Apply role-based permissions appropriately
• Verify joiner mover leaver changes
• Escalate conflicting or excessive access

Network and Endpoint Protection

• Separate network zones by trust
• Apply controls at traffic boundaries
• Protect endpoints using layered security
• Review exceptions weakening segmentation

Day 3: Protecting Data and Responding to Security Events

Cybersecurity Data Protection and Encryption

• Identify data requiring encryption
• Select controls across data states
• Coordinate keys under approved responsibilities
• Verify encryption remains effective post-change

Threat Monitoring and Detection

• Identify events requiring security monitoring
• Separate normal activity from suspicious
• Correlate alerts before incident escalation
• Build monitoring view for signals

Incident Response and Recovery

• Identify events requiring incident escalation
• Preserve essential facts and evidence
• Coordinate containment communication recovery
• Draft concise recovery checklist

Day 4: Managing Vulnerabilities, Suppliers, and Compliance

Cybersecurity Vulnerability and Patch Control

• Inventory systems requiring updates
• Rank vulnerabilities by exposure impact
• Test patches through controlled changes
• Monitor exceptions until risk closure

Cybersecurity Supplier Risk

• Map supplier data and access
• Assess provider controls against safeguards
• Define assurance evidence for reviews
• Track unresolved third-party risk actions

Security Compliance and Auditing

• Identify evidence demonstrating control operation
• Organize records for efficient review
• Link findings to requirements controls
• Track corrective actions through closure

Day 5: Building Security Awareness and Maturity

Awareness and Secure Behavior

• Identify high-risk security behaviors
• Equip leaders to model security
• Build support for secure behavior
• Measure behavior change after awareness

Performance Measures and Maturity Levels

• Use consistent maturity assessment criteria
• Validate ratings through evidence interviews
• Separate foundational gaps from enhancements
• Track maturity with periodic reassessment

Cybersecurity Improvement Plan

• Sequence cybersecurity improvements into stages
• Assign improvement owners and deadlines
• Link security dependencies with decisions
• Define evidence confirming improvement stages

• Evidence-based discussion of cyber threat landscape in realistic settings
• Structured practice applying network and endpoint protection to participant work contexts
• Decision simulations testing supplier and supply-chain risks against defined criteria
• A final workshop consolidating learning into a cybersecurity improvement plan ranked by risk